MR138 Privacy Policy – Malaysian Player Data Protection

MR138 collect your personal data through several different channels. We only gather information that is strictly necessary to provide you, as a Malaysia player, with a safe, fair and efficient service. The categories of data we collect are as follows:

Data You Provide Directly

• Registration Information: Full name, active Malaysian phone number, email address, date of birth, and a password of your choice when registering a new MR138 account.
• Identity Verification (KYC) Information: A copy of your Malaysian Identity Card (MyKad), bank account name and account details required for verification prior to your first withdrawal.
• Financial Information: Payment methods used, such as Touch 'n Go eWallet, GrabPay, DuitNow, Boost, ShopeePay, FPX, Maybank2u, or CIMB Clicks — including account numbers required to process your deposits and withdrawals.
• Support Communications: Records of live chat conversations, emails and any other communications you have had with the MR138 customer support team.

Automatically Collected Data

• Technical Data: IP address, browser type and version, device operating system, screen resolution, and other technical information automatically transmitted by your device when accessing the MR138 platform.
• Game Activity Data: Game history, total wagers, wins, losses, bonuses used, and all activity associated with your MR138 account.
• Session Data: Login dates and times, session duration, pages visited and navigation paths within the MR138 platform.
• Cookie Data: Information stored via cookies and similar tracking technologies — described in further detail in Section 5.

MR138 uses your personal data responsibly and only for legitimate purposes. We never use your data beyond the scope described below without obtaining your additional consent.

• Service Provision: Processing account registration, managing deposits and withdrawals using your preferred payment method, processing winnings, and handling bonuses and promotions you have claimed.
• Identity Verification: Conducting the KYC process to verify that you are the legitimate account holder and to comply with anti-money laundering requirements.
• Security & Fraud Prevention: Identifying and blocking suspicious activity, preventing unauthorised access to your account, and protecting the integrity of the MR138 platform from misuse.
• Customer Support: Providing technical assistance and efficient customer support when you reach out to the MR138 team via live chat, WhatsApp, or email.
• Responsible Gaming: Monitoring play patterns to identify players who may need support, activating set deposit limits, and managing self-exclusion requests.
• Service Communications: Sending important notifications regarding transactions, changes to terms, security updates, and information relevant to your MR138 account. These notifications are part of the service and cannot be unsubscribed from.
• Marketing (with Consent): If you have consented to receive marketing communications, we will send you information about MR138 promotions, bonuses and special offers. You may withdraw this consent at any time through your account settings or by contacting our support team.
• Platform Improvement: Analysing usage patterns in aggregate (without identifying individuals) to understand the most popular features and continuously improve the playing experience at MR138.

Protecting your data is our number one priority MR138. We continuously invest in our security infrastructure to ensure your personal and financial information remains protected at all times. The following are the layers of protection we have in place:

• Data Encryption in Transit: All communications between your browser and MR138 servers are protected by TLS 1.3 with 256-bit SSL encryption. This means that even if someone intercepts your network traffic, they won't be able to read its contents.
• Data Encryption at Rest: Sensitive data such as identity card details, bank account information and transaction history are stored in encrypted format within our databases. Your password is stored as a one-way hash that cannot be decrypted.
• Internal Access Controls: Only MR138 staff with a legitimate business need and who have passed stringent background checks are permitted to access members' personal data. All access is logged and regularly audited.
• Two-Factor Authentication (2FA): MR138 supports and encourages the use of two-factor authentication for your account. This feature adds an extra layer of security even if your password is compromised.
• Continuous Security Monitoring: MR138's security system monitors for unusual activity on the platform 24 hours a day. Suspicious login attempts or activity indicating account compromise will be detected and acted upon immediately.
• Fund Segregation: Player funds are held in accounts separate from MR138's operational funds. This ensures your money is always available for withdrawal, unaffected by the company's day-to-day financial operations.

MR138 does not sell, rent, or trade your personal data to any party for commercial purposes. However, in the course of providing our services, there are certain circumstances where we need to share your data with trusted parties:

• Payment Providers: To process your deposits and withdrawals, we are required to share the necessary transaction details with payment service providers such as Touch 'n Go, GrabPay, DuitNow, Maybank2u, and the FPX network. These providers operate under their own strict privacy policies and security standards.
• Game Providers: Game session data required to run games may be shared with third-party game providers such as Pragmatic Play, PG Soft, and JILI Games. This data is the minimum necessary to operate the games and does not include personally identifiable information.
• Identity Verification Services: For the KYC process, we may use verified and regulated third-party identity verification services to validate the authenticity of the identification documents you submit.
• Legal Authorities: MR138 complies with valid court orders and requests from Malaysian legal authorities when required by law. We will notify you of any such disclosure to the extent permitted by applicable law.
• Professional Advice: In certain situations, we may need to share relevant information with our legal advisors, accountants, or auditors, all of whom are bound by strict professional confidentiality obligations.

Platform MR138 uses cookies and similar tracking technologies to enhance your experience. Cookies are small text files stored by your browser when you visit our website. The following are the types of cookies we use:

• Essential Cookies: These cookies are essential for the basic functionality of the MR138 platform, such as maintaining your login session, remembering language preferences and ensuring transaction security. Without them, the platform cannot function properly. This type of cookie cannot be disabled.
• Performance Cookies: We use analytics cookies to understand how players interact with the MR138 platform — which pages are visited most frequently, how long users spend on them, and common navigation paths. This information is collected in aggregate without identifying individuals and is used to improve the platform.
• Functional Cookies: These cookies remember your preferences — such as favourite games, display settings, and language selection — so you don't have to reconfigure them every time you log in to MR138.
• Security Cookies: Used to detect suspicious activity, prevent fraud and protect your account from unauthorised access. These cookies store a unique session token to verify your identity throughout each session.

Managing Cookies: You can manage and control cookies through your browser settings. However, disabling certain cookies may affect the functionality of the MR138 platform and impact your experience. Essential cookies cannot be disabled without affecting your ability to log in to your MR138 account.

As a member MR138, you have the following rights regarding your personal data. We are committed to respecting and facilitating the exercise of these rights:

To exercise any of the rights above, contact the MR138 privacy team at support@mr138.best by stating the right you wish to exercise along with the account information needed to verify your identity. We will process your request within 14 business days and provide a clear response on the action taken.

MR138 retain your personal data only for as long as necessary to fulfil the purposes set out in this Privacy Policy, or as required by applicable law. The following are general guidelines for our data retention periods:

• Active Account Data: Your account data is retained for as long as your MR138 account remains active. This includes profile information, game history, and transaction records required to keep the account running smoothly.
• Post-Account Closure Data: Upon account closure, we will retain your financial transaction records and KYC documents for a minimum of 5 years to comply with Malaysia's anti-money laundering legal requirements.
• Support Communication Data: Records of conversations with the MR138 support team are retained for 2 years from the date of communication for quality control and dispute resolution purposes.
• Security Logs: Access logs and security data are retained for 12 months to assist in the investigation of any security incidents that may arise.
• Marketing Data: If you withdraw consent for marketing communications, we will delete your marketing data within 30 days. However, your name may be retained on a "do not contact" list to ensure we do not send you communications inadvertently.

Platform MR138 is exclusively for adults aged 18 and above. We do not knowingly collect or store personal data from individuals under the age of 18.

Should we discover that data belonging to a child or minor was collected without our knowledge through the registration process, we will take the following immediate action: suspend the account in question, delete all associated data and refund any deposits made to the original payment method.

MR138 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our practices, new legal requirements, or platform improvements. All changes take effect once the updated version is published on the MR138 website.

For material changes — that is, changes that significantly affect how we collect, use, or share your data — we will notify you by email to the address registered with your MR138 account at least 14 days before the changes take effect. This gives you sufficient time to review the changes and decide whether you wish to continue using the MR138 platform.

The "Last Updated" date at the top of this page reflects the date of the most recent amendment. We encourage you to review this Privacy Policy page periodically to stay informed about how we protect your information. Continued use of the MR138 platform following any notified amendment will be considered acceptance of the latest version of this Privacy Policy.

If you have any questions, concerns or complaints regarding MR138's Privacy Policy or how we handle your personal data, our team is here to help. We take every privacy-related enquiry seriously and are committed to providing clear, satisfactory responses.

• Privacy Email: support@mr138.best – for privacy-specific enquiries and data rights requests, please include "Privacy Enquiry" in the subject line of your email.
• 24/7 Live Chat: Contact the MR138 support team via live chat on the platform for general privacy enquiries that require an immediate response.
• Response Time: Privacy enquiries will be responded to within 3 working days. More complex data rights requests, such as data access or deletion requests, will be processed within 14 working days.